New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

A newly discovered vulnerability in the Linux kernel's KVM virtualization layer exposes host memory to guest virtual machines running on ARM64 systems with nested virtualization enabled.

The flaw, tracked as CVE-2026-89775, permits guest VMs to read and write host kernel memory directly. Security researcher analysis indicates the vulnerability enables full guest-to-host escape, allowing an attacker controlling a guest VM to execute arbitrary code on the physical host machine.

The bug resides in KVM's ARM64 implementation, specifically in how the hypervisor manages memory access controls between nested virtual machines and the underlying host kernel. When nested virtualization is active, a compromised or malicious guest gains the ability to access freed memory regions that belong to the host kernel. This access proves sufficient for attackers to map kernel structures, leak sensitive data, and craft exploits that break the isolation boundary between guest and host.

Nested virtualization, a feature allowing virtual machines to run hypervisors themselves, introduces additional complexity in memory isolation logic. The flaw stems from improper handling of memory regions that have been freed but not yet reclaimed by the hypervisor. Guest VMs can exploit this window to establish read-write access, creating a direct path for privilege escalation and complete host compromise.

ARM64 systems remain dominant in mobile, embedded, and increasingly server environments. Linux deployments using KVM for virtualization span cloud providers, container platforms, and enterprise infrastructure. Organizations running nested virtualization on ARM64 hardware face direct exposure. This includes cloud providers offering nested KVM capabilities to tenants, on-premises infrastructure using ARM-based servers for virtualization workloads, and embedded Linux systems implementing hypervisor functionality.

An attacker with the ability to launch or control a guest VM on an affected host can escalate privileges to root level kernel access within seconds. From that position, the attacker can install rootkits, steal encryption keys, access data from other guest VMs, or disable security monitoring entirely. Lateral movement across the infrastructure becomes possible if the compromised host connects to internal networks.

The vulnerability requires two conditions. First, nested virtualization must be explicitly enabled on the host. Second, the attacker needs some level of control over a guest VM, either through existing access or by gaining the ability to launch one. This places risk primarily with infrastructure operators rather than individual users, though shared hosting environments and multi-tenant cloud platforms represent clear targets.

Linux maintainers have begun addressing the issue through kernel patches applied to the KVM ARM64 code. The fix involves correcting memory access control checks to prevent guests from accessing freed host kernel pages. Distributors including Red Hat, Canonical, and Debian will backport patches to supported kernel versions.

Organizations running ARM64-based virtualized infrastructure should prioritize kernel updates when patches become available. System administrators should audit their deployments to identify hosts with nested virtualization enabled, as disabling this feature where unnecessary eliminates exposure entirely. For those requiring nested virtualization, applying patches as soon as possible limits the attack window.

The flaw demonstrates ongoing complexity in hypervisor security, particularly as virtualization architectures layer additional abstraction levels. Nested virtualization introduces attack surface that single-level virtualization avoids. Kernel maintainers continue identifying and addressing such boundary violations, but proactive patching remains essential for defense.